status(redfix): record the b5f2b10 MERGE PRECONDITION; widen B-redfix-5 to both post-undeploy sites

Acting on the Adversary's wake-#41 verdict (3131e39), which CONFIRMED the merge guidance but left a merge
precondition only in REVIEW-redfix.md — Adversary-owned, and not what an operator reads before merging.
Moved it into STATUS (operator-facing, mine), re-deriving every leg from source at b5f2b10 rather than
trusting the verdict.

- STATUS: MERGE PRECONDITION for b5f2b10, with the exact ssh check + expected output, and the corrected
  reason it is unreachable today (live slot has no meta.json — NOT "F-redfix-4 is closed").
- Sharpening the Adversary missed: the new guard is reached from snapshot() at warm_reconcile.py:514 as
  well as restore() at :536. Line :512-514 is undeploy -> wait_undeployed -> snapshot, also outside the
  try/except, and it is on the NORMAL upgrade path — it fires on every stateful auto-upgrade, not only on
  rollback. B-redfix-5 as filed named only the rollback site.
- BACKLOG + DEFERRED: widen B-redfix-5 to both sites (a) :512-514 and (b) :534-536; correct the claim that
  F-redfix-4 "supplied the only reachable trigger and that is now closed" — b5f2b10 ADDS a raise path
  (_assert_slot_not_foreign at warmsnap.py:158 and :209).

Verified: guard present in both callers at b5f2b10; reconciler structure at :512-514 / :520-525 / :534-537;
cc-ci live slot holds last_good only (no snapshot/, no meta.json, no canon-* slot). Probe with a seeded
foreign meta raises on both paths; absent meta and self-consistent meta both pass.

No DoD item touched. M1+M2 PASS stand, ## DONE stands, no VETO. Docs-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZmH4rVNue3irZ6EsZzavb

machine-docs/STATUS-redfix.md

@@ -70,9 +70,32 @@ F-redfix-4 and is re-asserted here only after the remedy was Adversary-verified.
 and the still-open non-blocking B-redfix-5, are below.
 
 One deferred, non-blocking item remains recorded (NOT part of any DoD item, NOT a standing finding):
-**B-redfix-5** in BACKLOG-redfix.md — `warm_reconcile.py`'s rollback `warmsnap.restore()` sits outside the
-upgrade's `try/except`. Pre-dates the enrollment (present at `07fc6d4`); F-redfix-4 supplied the only
-*reachable* trigger and that is now closed. Adversary concurred it is not a VETO.
+**B-redfix-5** in BACKLOG-redfix.md — in `warm_reconcile.py`, TWO post-`abra.undeploy()` calls sit outside
+the upgrade's `try/except`: `warmsnap.snapshot()` on the upgrade path (`:514`) and `warmsnap.restore()` on
+the rollback path (`:536`). If either raises, live keycloak is left **undeployed**. Pre-dates the
+enrollment (present at `07fc6d4`). Adversary concurred it is not a VETO.
+
+**MERGE PRECONDITION for `b5f2b10` (verify at merge time).** The F-redfix-4 fix *adds* a raise path to both
+of those calls — `warmsnap._assert_slot_not_foreign()` (`warmsnap.py:158` in `snapshot()`, `:209` in
+`restore()`). It raises iff the live slot's `snapshot/meta.json` records a `domain` other than the one
+passed. Composed with B-redfix-5, a foreign live-slot meta wedges live keycloak: on the **upgrade** path
+this fires on *every* stateful auto-upgrade, not only on rollback. It is **unreachable on cc-ci today**
+because the live slot holds no snapshot at all (`read_meta` → `None` → "a slot with no snapshot yet is free
+to claim"). It is unreachable for that reason — **not** because F-redfix-4 is closed.
+
+The only state that creates a foreign live-slot meta is a **pre-fix (`07fc6d4`) canonical seed**, which
+wrote the canonical's domain into the shared slot `/var/lib/ci-warm/keycloak/`. So: do not run a canonical
+keycloak seed from `07fc6d4` between now and the merge.
+
+**HOW to verify the precondition** (on cc-ci; `python3` is absent there, so `ls`/`cat`):
+
+    ssh cc-ci 'ls -A /var/lib/ci-warm/keycloak/; cat /var/lib/ci-warm/keycloak/snapshot/meta.json 2>&1'
+
+**EXPECTED (observed 2026-07-09T08:2xZ):** `last_good` only, and `cat` reports
+`No such file or directory` — no `snapshot/`, hence no `meta.json`. **A `meta.json` whose `"domain"` is
+anything other than `warm-keycloak.ci.commoninternet.net` means the precondition is violated:** fix B-redfix-5
+(or delete the foreign slot meta) BEFORE merging `b5f2b10`. A `meta.json` recording
+`warm-keycloak.ci.commoninternet.net` is self-consistent and passes the guard.
 
 ---